@catalyst-cloud/cli 0.16.23 → 0.16.25

package/CHANGELOG.md

@@ -1,5 +1,15 @@
 # Changelog
 
+## 0.16.25
+
+A self-hosted machine that runs several teams' work from one `compose.json` can now take each approved release by itself. Run `catalyst runner update --fleet --dir <the folder that holds compose.json>`, by hand or on a schedule. It switches only the supervisor to the approved images and leaves work that is already running alone. If the machine's teams are not ready again within four minutes, it puts the previous images back. `--check` shows what would change without changing anything.
+
+## 0.16.24
+
+One self-hosted machine can now work for several Linear teams. On a machine already set up for one team, run `catalyst setup --runner` with another team selected, and setup adds that team instead of stopping. Each team's own setting still decides whether its work may run there, and the machine asks each of its teams for work in turn. A new machine starts on Catalyst's current approved release, which can serve several teams from its first setup; a machine you already set up gets that release on its next 15-minute update check.
+
+New: `catalyst mcp status <server>` shows one MCP server's state, how it authenticates, how many of its tools are granted to this machine's login, and how many tools it offers. It then lists the server's last 50 tool calls: when each ran, the ticket and phase it ran for, the tool, how long it took and the outcome. A call that failed names its reason in plain words. The command exits 0 whenever it could read the server, even when some of the calls failed. `--json` prints the server's status and calls exactly as Catalyst Cloud returns them.
+
 ## 0.16.23
 
 You can now answer an ask by telling your agent in chat, and have the agent record it for you. `catalyst ask answer <ask> --proxy --quote "<your exact words>" --said-in <session>` records your words on the ask as an answer by proxy, with `--option <letter>` when you picked one. It is kept apart from answers you give on the ask yourself, and the work the ask held moves on. It works only on your own asks, and only after you turn it on with `catalyst ask proxy on` (`catalyst ask proxy` shows whether it is on; `off` turns it off). If an agent recorded something you did not mean, `catalyst ask disown <ask>` takes it back and reopens the ask. Update the Catalyst plugin's skills with the CLI so your agent knows when it may do this.

package/README.md

@@ -236,7 +236,7 @@ Some of these only read, and some write: a comment, a card move, an ask, a relea
 
 ## What a key cannot see yet
 
-Your personal key reads everything the skills need — tickets, pull requests, the eligibility explainer, the dispatch queue, fleet activity, per-ticket execution history (`catalyst explain --history <ticket>`: phase attempts, remediation rounds, park state) and coding-account status (`catalyst accounts`: provider, declared and observed state, usage limits, walls, quarantine — never a credential; enrolling or pausing one is `<your cloud>/settings/coding-accounts`, with no command yet). It also releases a parked or held ticket once its cause is fixed: `catalyst release <ticket> --because <what changed>` (the `unstick` skill runs it), recorded against your name and shown in the ticket's history. And it declares what your containers need: `catalyst environment` reads the account-wide declaration, `environment propose --file <path> --approve` proposes and approves it in one compare-and-set, and the values behind the names stay in the cloud — reading needs any active seat, proposing and approving need an admin or owner one. An admin or owner can put a repository's values in from the terminal. `catalyst secret import .env --repo owner/name` stores every name in the file and lists the declared names that still have no value. `catalyst secret set NAME --repo owner/name --command 'op read op://Vault/item/field'` runs the command on your machine and stores its output; with no `--command` it reads the value from stdin, or asks for it without echoing. No value is ever printed, and the cloud's audit records the command, not its output. That is the account's own declaration — a repository's own `.catalyst/catalyst.toml`, which `catalyst-onboard` already reports on, is a separate thing. `catalyst env inventory` lists the environment variable names a repository needs — never a value; `env check` checks the TOML syntax and environment variable table in `.catalyst/catalyst.toml` offline; `env migrate [catalyst.env.json]` prints a TOML environment table from a legacy declaration, with all names optional and values omitted. These commands need no login (the `what-this-repo-needs` skill walks through them). Two things it cannot do, and the skills say so by name rather than guess:
+Your personal key reads everything the skills need — tickets, pull requests, the eligibility explainer, the dispatch queue, fleet activity, per-ticket execution history (`catalyst explain --history <ticket>`: phase attempts, remediation rounds, park state) and coding-account status (`catalyst accounts`: provider, declared and observed state, usage limits, walls, quarantine — never a credential; enrolling or pausing one is `<your cloud>/settings/coding-accounts`, with no command yet). It also releases a parked or held ticket once its cause is fixed: `catalyst release <ticket> --because <what changed>` (the `unstick` skill runs it), recorded against your name and shown in the ticket's history. And it declares what your containers need: `catalyst environment` reads the account-wide declaration, `environment propose --file <path> --approve` proposes and approves it in one compare-and-set, and the values behind the names stay in the cloud — reading needs any active seat, proposing and approving need an admin or owner one. An admin or owner can put a repository's values in from the terminal. `catalyst secret import .env --repo owner/name` stores every name in the file and lists the declared names that still have no value. `catalyst secret set NAME --repo owner/name --command 'op read op://Vault/item/field'` runs the command on your machine and stores its output; with no `--command` it reads the value from stdin, or asks for it without echoing. No value is ever printed, and the cloud's audit records the command, not its output. That is the account's own declaration — a repository's own `.catalyst/catalyst.toml`, which `catalyst-onboard` already reports on, is a separate thing. `catalyst env inventory` lists the environment variable names a repository needs — never a value; `env check` checks the TOML syntax and environment variable table in `.catalyst/catalyst.toml` offline; `env migrate [catalyst.env.json]` prints a TOML environment table from a legacy declaration, with all names optional and values omitted. `env draft --write` writes a new `.catalyst/catalyst.toml` from the repository's files and from this computer — the names the repository's `.envrc` exports, and Claude Code's HTTP MCP servers with each header as a variable reference — then offers to store this computer's values; `catalyst env import` stores them later. A value is never written to the file or printed. These commands need no login, except `env import` (the `what-this-repo-needs` skill walks through them). Two things it cannot do, and the skills say so by name rather than guess:
 
 - Read pull-request labels or the reviewer's reaction. The mirror does not carry them; GitHub's own page does.
 - Compute a flow number — cycle time, throughput, or how long pull requests have been open. Nothing serves those yet, so say they are not computed rather than counting something else and calling it that.

package/dist/args.js

@@ -25,6 +25,7 @@ export const FLAG_TABLES = {
         check: { value: false, help: "read the approved release and say what would change, without changing it" },
         auto: { value: false, help: "one-line output for the scheduled run" },
         dir: { value: true, help: "the runner directory (default: the one setup created)" },
+        fleet: { value: false, help: "update a multi-team supervisor fleet's compose.json in --dir" },
     },
     login: {
         "start-replica": {
@@ -357,7 +358,7 @@ export const FLAG_TABLES = {
     env: {
         root: {
             value: true,
-            help: "draft, shell: repository directory (default: the current repository's top level)",
+            help: "draft, import, shell: repository directory (default: current directory; shell: the current repository's top level)",
         },
         write: {
             value: false,
@@ -367,6 +368,18 @@ export const FLAG_TABLES = {
             value: false,
             help: "draft: show the generated TOML as an additions-only diff",
         },
+        "import-values": {
+            value: false,
+            help: "draft: after --write, store this computer's values for the declared names without asking",
+        },
+        repo: {
+            value: true,
+            help: "draft --import-values, import: the repository (owner/name); default: this checkout's GitHub origin",
+        },
+        yes: {
+            value: false,
+            help: "import: store without asking (needed without a terminal)",
+        },
         "env-file": {
             value: true,
             repeat: true,
@@ -532,7 +545,7 @@ export const FLAG_TABLES = {
 };
 export const VERB_USAGE = {
     hosts: "hosts [list] | hosts remove <name-or-id> [--yes] | hosts rename <name-or-id> <new-name> [--json]",
-    runner: "runner update [--check] [--dir <runner directory>] | runner auto-update [status|on|off]",
+    runner: "runner update [--check] [--dir <runner directory>] [--fleet] | runner auto-update [status|on|off]",
     setup: "setup [onboard options]   (sets up Catalyst step by step; same as catalyst onboard) | setup --engine <file> --engine-sha256 <hex> [-- <install options>]   (run by install.sh; install.sh --help lists the options)",
     login: "login [--base-url <url>] [--start-replica]   (keyless; or --key <personal-key> / CATALYST_CLOUD_TOKEN)",
     onboard: "onboard [--team <ID|key>] [--repo <owner/name>]... [--coding-account <slot>] [--resume-from <step>] [--only <step>] [--local-sync] [--runner|--no-runner] [--no-color] [--yes] [--dry-run] [--json] | onboard --headless [--key-file <path>] [--team ...] [--repo ...]... [--coding-account ...] [--runner yes|no] [--json]",
@@ -555,9 +568,9 @@ export const VERB_USAGE = {
     ready: "ready [--onboarding] [--local-sync] [--json] [--offline]",
     accounts: "accounts [--all] [--json]",
     seat: "seat checkout --size big|med --harness claude,codex,opencode [--session-id ID] [--stage STAGE] [--key-env NAME]",
-    mcp: "mcp <add <name> --url URL <--auth none|--bearer SECRET_NAME|--header NAME=SECRET_NAME...>|list|remove <name>> [--json]",
+    mcp: "mcp <add <name> --url URL <--auth none|--bearer SECRET_NAME|--header NAME=SECRET_NAME...>|list|remove <name>|status <name>> [--json]",
     team: "team <list|check <KEY>|check --all|map <KEY> [--stage role=StateName]... [--yes --plan-hash H]|adopt <KEY> [--undo] [--yes --plan-hash H]|migrate <KEY> [--choice sourceId=destinationId]... [--retire] [--yes --plan-hash H]|checklist <KEY>> [--json]",
-    env: "env <inventory [path] | check <file> | migrate [catalyst.env.json] | draft [--root DIR] [--diff] [--write] | shell [--root DIR] [--env-file FILE]... [--image REF] [--check]> [--json]   (THIS repository; no login — shell needs Docker and downloads Catalyst's image once)",
+    env: "env <inventory [path] | check <file> | migrate [catalyst.env.json] | draft [--root DIR] [--diff] [--write [--import-values]] | import [--root DIR] [--repo owner/name] [--yes] | shell [--root DIR] [--env-file FILE]... [--image REF] [--check]> [--json]   (THIS repository; no login, except import and --import-values, which sign in and store values — shell needs Docker and downloads Catalyst's image once)",
     environment: "environment [read] [--json] | environment propose --file <path>|--stdin [--expect-revision N] [--approve] [--json] | environment approve [--revision N --hash H] [--json]   (your ACCOUNT's declaration; needs login)",
     secret: "secret set <NAME> --repo <owner/name> [--command '<cmd>'] [--json]   (value from --command, stdin, or a hidden prompt) | secret import <file> --repo <owner/name> [--names NAME[,NAME...]] [--rotate NAME]... [--json]",
     var: "var <set NAME|import <file>> [--repo <owner/name>] [--names NAME[,NAME...]] [--json]   (plain environment variables; set reads stdin or a hidden prompt)",

package/dist/capabilities.js

@@ -37,6 +37,7 @@ export const CAPABILITIES = [
     { verb: "environment approve", does: "approve the workspace-wide environment declaration", needs: "admin", routes: [agent("POST", "account-environment/approve")], since: "0.8.0" },
     { verb: "secret set|import", does: "enter a repository secret's value from this terminal, never echoed", needs: "admin", routes: [], since: "0.8.0" },
     { verb: "var set|import", does: "enter plain environment variable values from this terminal, never echoed", needs: "admin", routes: [], since: "0.13.2" },
+    { verb: "env import", does: "store this computer's values for the names .catalyst/catalyst.toml declares, never printed", needs: "admin", routes: [], since: "0.16.20" },
     { verb: "accounts", does: "read the workspace's coding accounts and which can take work", needs: "member", routes: [], since: "0.5.0" },
     { verb: "explain|running|queue|history", does: "read why a ticket runs or waits, what runs now, and what is queued", needs: "member", routes: [], since: "0.1.0" },
     { verb: "write comment|state|label|create|reaction|attachment|session", does: "act on a ticket as the person, through the agent proxy", needs: "member", routes: [agent("POST", "issue-comment"), agent("POST", "issue-state"), agent("POST", "issue-label"), agent("POST", "issue-create")], since: "0.1.0" },
@@ -46,6 +47,7 @@ export const CAPABILITIES = [
     { verb: "ask disown", does: "take back an answer recorded by proxy on your ask, reopening it (your own login only)", needs: "member", routes: [], since: "0.16.23" },
     { verb: "release", does: "release a parked ticket or a whole failure class back to work", needs: "admin", routes: [agent("POST", "ticket-release"), agent("POST", "ticket-release-class")], since: "0.6.0" },
     { verb: "mcp add|list|remove", does: "register an MCP server for the workspace by vault-secret name", needs: "admin", routes: [agent("POST", "mcp")], since: "0.9.0" },
+    { verb: "mcp status", does: "read an MCP server's state, auth kind, grants for this key, tool count and its last 50 tool calls with each failure's reason", needs: "member", routes: [], since: "0.16.24" },
 ];
 /** Judge each capability against the routes a contract serves. `null` means no contract is cached,
  *  so nothing that rides a route can be called available; local and read-plane verbs still are. */

package/dist/cli.js

@@ -86,7 +86,7 @@ export function usageText() {
         "  catalyst seat checkout --size big|med --harness claude,codex,opencode [--session-id ID] [--stage STAGE]",
         "  catalyst hosts [list] | hosts remove <name-or-id> [--yes] | hosts rename <name-or-id> <new-name>",
         "  catalyst runner update [--check] | runner auto-update [status|on|off]   (move this machine's runner to the approved release)",
-        "  catalyst mcp add|list|remove (vault references only)",
+        "  catalyst mcp add|list|remove (vault references only) | mcp status <name>   (a server's state, grants and last 50 tool calls)",
         "  catalyst contract [--refresh] [--path <a.b.c>]",
         "  catalyst query <issues|issue <id>|pulls|pull <id>|projects|cycles|search <terms>|changes --since <cursor|head>>",
         '  catalyst replica <start [--detach]|stop|status [--probe]|sql "<select>"|schema [table]>',

package/dist/env/draft.js

@@ -2,41 +2,35 @@ import { readFileSync } from "node:fs";
 import { join } from "node:path";
 import { convertLegacyEnvironmentJson } from "./legacy.js";
 import { inventoryRepo } from "./inventory.js";
+import { scanMachine } from "./machine.js";
+import { mcpServerToml } from "./scan-claude-mcp.js";
 import { walkRepo } from "./walk.js";
 const SECRET_NAME_RE = /(?:^|_)(?:API_?KEY|AUTH|CREDENTIALS?|PASSWORD|PRIVATE_?KEY|SECRET|TOKEN)(?:_|$)/i;
 const ENV_NAME_RE = /^[A-Za-z_][A-Za-z0-9_]*$/;
 const MAX_VARIABLES = 128;
+/** The draft's secret rule: a name that says it holds a key, a token, a password or a secret. */
+export function isSecretName(name) {
+    return SECRET_NAME_RE.test(name);
+}
 /** Build a stable, value-free environment table from repository evidence. `.env` is never read:
  *  inventoryRepo's walker only opens supported examples and source/config files. The legacy
- *  declaration is parsed for names and explicit secret flags, and no legacy value escapes. */
-export function draftEnvironment(root, deps = {}) {
-    const inventory = inventoryRepo(root, deps);
+ *  declaration is parsed for names and explicit secret flags, and no legacy value escapes.
+ *  With `options.machine`, the names this computer's `.envrc` exports and Claude Code's HTTP MCP
+ *  servers join the draft (`catalyst env draft`); without it (`catalyst onboard`) nothing changes. */
+export function draftEnvironment(root, deps = {}, options = {}) {
+    const repository = repositoryNames(root, deps);
+    if (repository.state === "invalid")
+        return repository;
+    const { names, secrets, sources } = repository;
     const files = (deps.listFiles ?? walkRepo)(root);
-    const names = new Set();
-    const secrets = new Set();
-    const sources = new Set();
-    for (const entry of inventory.entries) {
-        if (entry.group === "bindings" || !entry.needsDeclaration || !ENV_NAME_RE.test(entry.name))
-            continue;
-        names.add(entry.name);
-        if (SECRET_NAME_RE.test(entry.name))
-            secrets.add(entry.name);
-        for (const finding of entry.found)
-            sources.add(finding.file);
-    }
-    const legacyPath = join(root, "catalyst.env.json");
-    const legacy = deps.readFile !== undefined ? deps.readFile(legacyPath) : readOptional(legacyPath);
-    if (legacy !== undefined) {
-        const converted = convertLegacyEnvironmentJson(legacy);
-        if (converted.state === "invalid")
-            return converted;
-        for (const name of converted.variableNames)
-            names.add(name);
-        for (const name of converted.secretNames)
-            secrets.add(name);
-        if (converted.variableNames.length > 0)
-            sources.add("catalyst.env.json");
-    }
+    const machine = options.machine === undefined ? null : scanMachine(root, options.machine, new Set(names));
+    for (const name of machine?.names ?? [])
+        names.add(name);
+    for (const name of machine?.secretNames ?? [])
+        secrets.add(name);
+    for (const source of machine?.sources ?? [])
+        sources.add(source);
+    const mcpServers = machine?.claude?.servers ?? [];
     const sortedNames = [...names].sort((a, b) => a.localeCompare(b, "en"));
     if (sortedNames.length > MAX_VARIABLES) {
         return { state: "invalid", errors: [`environment has more than ${MAX_VARIABLES} names`] };
@@ -59,7 +53,7 @@ export function draftEnvironment(root, deps = {}) {
             "required = false",
             "",
         ].join("\n"));
-    chunks.push(...standard.setup, ...standard.verify);
+    chunks.push(...mcpServers.map(mcpServerToml), ...standard.setup, ...standard.verify);
     const toml = `${chunks.join("\n").replace(/\n{3,}/g, "\n\n").trimEnd()}\n`;
     return {
         state: "valid",
@@ -69,8 +63,41 @@ export function draftEnvironment(root, deps = {}) {
         verify: standard.verify,
         toml,
         sources: [...sources].sort((a, b) => a.localeCompare(b, "en")),
+        mcpServers,
+        machine,
     };
 }
+/** The names the repository itself declares: its examples, source and config files, and the legacy
+ *  `catalyst.env.json`. A derived MCP header variable must not take one of these (`scanMachine`). */
+export function repositoryNames(root, deps = {}) {
+    const inventory = inventoryRepo(root, deps);
+    const names = new Set();
+    const secrets = new Set();
+    const sources = new Set();
+    for (const entry of inventory.entries) {
+        if (entry.group === "bindings" || !entry.needsDeclaration || !ENV_NAME_RE.test(entry.name))
+            continue;
+        names.add(entry.name);
+        if (isSecretName(entry.name))
+            secrets.add(entry.name);
+        for (const finding of entry.found)
+            sources.add(finding.file);
+    }
+    const legacyPath = join(root, "catalyst.env.json");
+    const legacy = deps.readFile !== undefined ? deps.readFile(legacyPath) : readOptional(legacyPath);
+    if (legacy !== undefined) {
+        const converted = convertLegacyEnvironmentJson(legacy);
+        if (converted.state === "invalid")
+            return converted;
+        for (const name of converted.variableNames)
+            names.add(name);
+        for (const name of converted.secretNames)
+            secrets.add(name);
+        if (converted.variableNames.length > 0)
+            sources.add("catalyst.env.json");
+    }
+    return { state: "valid", names, secrets, sources };
+}
 /** Conservative package.json/lockfile inference. No repository script is executed. */
 function standardSteps(root, files, deps) {
     if (!files.includes("package.json"))

package/dist/env/machine-values.js

@@ -0,0 +1,63 @@
+// machine-values.ts — this computer's values for the names a reviewed `.catalyst/catalyst.toml`
+// declares, for `catalyst env import` and `catalyst env draft --import-values`.
+//
+// ⛔ VALUES ARE HELD IN MEMORY AND RETURNED ONLY TO `src/env-import.ts`, which sends them in request
+// bodies and prints names. Nothing here logs, prints or writes a value.
+//
+// A value can come from four places, in this order, and nowhere else:
+//   1. the direnv environment: this process's environment, only when DIRENV_DIR names this
+//      repository and only for names `.envrc` exports and assigns (direnv has already run the file;
+//      a bare `export NAME` with no assignment would pass on whatever the shell held);
+//   2. a static literal in `.envrc`;
+//   3. a literal header in `~/.claude.json`, only for a variable the draft derived from that header;
+//   4. this process's environment, for a name a `~/.claude.json` header references, since that is
+//      where Claude Code itself reads it.
+// `.envrc` is never run, `direnv` is never called, and `.env` is never opened. The file's declared
+// names are the allowlist: a name this computer has but the file does not declare is never resolved.
+import { claudeHeaderLiterals, scanClaudeMcp } from "./scan-claude-mcp.js";
+import { envrcLiteralValues, scanEnvrc } from "./scan-envrc.js";
+import { readMachineFiles } from "./machine.js";
+export function resolveMachineValues(root, options, declared, repositoryNames = new Set()) {
+    const files = readMachineFiles(root, options);
+    const wanted = new Set(declared.map(({ name }) => name));
+    const envrc = files.envrcText === undefined ? null : scanEnvrc(files.envrcText);
+    const exported = new Map((envrc?.exported ?? []).map((entry) => [entry.name, entry]));
+    const literals = files.envrcText === undefined ? new Map() : envrcLiteralValues(files.envrcText, wanted);
+    const direnvDir = options.env.DIRENV_DIR;
+    const direnvLoaded = typeof direnvDir === "string" && files.repoRoots.some((path) => direnvDir === `-${path}`);
+    // The draft saw the repository's names and the `.envrc` names when it derived header variables;
+    // the same set keeps lookups aligned.
+    const envrcNames = new Set([...repositoryNames, ...exported.keys()]);
+    const headerLiterals = files.claudeText === undefined ? new Map() : claudeHeaderLiterals(files.claudeText, files.repoRoots, wanted, envrcNames);
+    const referenced = new Set();
+    if (files.claudeText !== undefined) {
+        for (const server of scanClaudeMcp(files.claudeText, files.repoRoots, envrcNames).servers) {
+            const derived = new Set(server.derived.map(({ variable }) => variable));
+            for (const name of server.references)
+                if (!derived.has(name))
+                    referenced.add(name);
+        }
+    }
+    const values = new Map();
+    const noValue = [];
+    for (const { name } of declared) {
+        const found = pick(
+        // A bare `export NAME` the file never assigns hands direnv the shell's own value: not the file's.
+        direnvLoaded && exported.has(name) && exported.get(name)?.inherited !== true ? [options.env[name], "direnv environment"] : undefined, [literals.get(name), ".envrc"], [headerLiterals.get(name), "~/.claude.json"], referenced.has(name) ? [options.env[name], "shell environment"] : undefined);
+        if (found !== null)
+            values.set(name, found);
+        else
+            noValue.push({ name, computed: exported.get(name)?.computed === true });
+    }
+    return { values, noValue };
+}
+function pick(...candidates) {
+    for (const candidate of candidates) {
+        if (candidate === undefined)
+            continue;
+        const [value, from] = candidate;
+        if (value !== undefined && value !== "")
+            return { value, from };
+    }
+    return null;
+}

package/dist/env/machine.js

@@ -0,0 +1,119 @@
+// machine.ts — what this computer adds to `catalyst env draft`: the names the repository's `.envrc`
+// exports and Claude Code's HTTP MCP servers. Names and references only; see `scan-envrc.ts` and
+// `scan-claude-mcp.ts` for why neither returns a value.
+//
+// ⛔ `.env` and `.dev.vars` are never opened, even through an `.envrc` that is a link to one: the
+// default reader resolves the real path first and refuses those basenames, the same rule the
+// repository inventory keeps.
+import { closeSync, fstatSync, openSync, readSync, realpathSync } from "node:fs";
+import { basename, join } from "node:path";
+import { isSecretName } from "./draft.js";
+import { scanClaudeMcp } from "./scan-claude-mcp.js";
+import { scanEnvrc } from "./scan-envrc.js";
+const ENVRC_CAP = 1024 * 1024;
+const CLAUDE_JSON_CAP = 32 * 1024 * 1024;
+const REFUSED_BASENAMES = new Set([".env", ".dev.vars"]);
+/** Read `.envrc` and `~/.claude.json` once, through the injected reader or the guarded default. */
+export function readMachineFiles(root, options) {
+    const notes = [];
+    const read = (path, cap, label) => {
+        if (options.readMachineFile)
+            return options.readMachineFile(path, cap);
+        const result = readGuarded(path, cap);
+        if (result.note !== undefined)
+            notes.push(`${label} ${result.note}`);
+        return result.text;
+    };
+    const envrcText = read(join(root, ".envrc"), ENVRC_CAP, ".envrc");
+    const claudeText = read(join(options.home, ".claude.json"), CLAUDE_JSON_CAP, "~/.claude.json");
+    return { envrcText, claudeText, repoRoots: repoRootsFor(root), notes };
+}
+function repoRootsFor(root) {
+    const roots = [root];
+    try {
+        const real = realpathSync(root);
+        if (real !== root)
+            roots.push(real);
+    }
+    catch {
+        // An unreadable root has no realpath; the given path is the only key.
+    }
+    return roots;
+}
+/** Scan this computer for names. Missing files leave their half null, so the draft is unchanged.
+ *  `repositoryNames` are the names the repository already declares; a derived MCP header variable
+ *  may take neither one of those nor an `.envrc` export. */
+export function scanMachine(root, options, repositoryNames = new Set()) {
+    const files = readMachineFiles(root, options);
+    const envrc = files.envrcText === undefined ? null : scanEnvrc(files.envrcText);
+    const names = new Set();
+    const secrets = new Set();
+    const sources = [];
+    for (const entry of envrc?.exported ?? []) {
+        names.add(entry.name);
+        if (isSecretName(entry.name))
+            secrets.add(entry.name);
+    }
+    if (envrc !== null && envrc.exported.length > 0)
+        sources.push(".envrc");
+    const claude = files.claudeText === undefined ? null : scanClaudeMcp(files.claudeText, files.repoRoots, new Set([...repositoryNames, ...names]));
+    for (const server of claude?.servers ?? []) {
+        for (const name of server.references) {
+            names.add(name);
+            secrets.add(name);
+        }
+    }
+    if (claude !== null && claude.servers.length > 0)
+        sources.push("~/.claude.json");
+    const sort = (values) => [...values].sort((a, b) => a.localeCompare(b, "en"));
+    return { envrc, claude, names: sort(names), secretNames: sort(secrets), sources, notes: files.notes };
+}
+/** UTF-8 (with or without a byte-order mark) or UTF-16LE with its mark, as Windows editors save it. */
+function decode(bytes) {
+    if (bytes[0] === 0xff && bytes[1] === 0xfe)
+        return { text: bytes.subarray(2).toString("utf16le") };
+    if (bytes[0] === 0xfe && bytes[1] === 0xff)
+        return { note: "is UTF-16 big-endian, which this reader does not decode; it was not read" };
+    if (bytes[0] === 0xef && bytes[1] === 0xbb && bytes[2] === 0xbf)
+        return { text: bytes.subarray(3).toString("utf8") };
+    if (bytes.includes(0))
+        return { note: "holds NUL bytes, so it is not UTF-8 text; it was not read" };
+    return { text: bytes.toString("utf8") };
+}
+function readGuarded(path, cap) {
+    let real;
+    try {
+        real = realpathSync(path);
+    }
+    catch {
+        return {};
+    }
+    if (REFUSED_BASENAMES.has(basename(real)))
+        return { note: `links to a ${basename(real)} file, which is never read; it was not read` };
+    let fd;
+    try {
+        fd = openSync(real, "r");
+    }
+    catch {
+        return { note: "could not be opened; it was not read" };
+    }
+    try {
+        const stat = fstatSync(fd);
+        if (!stat.isFile())
+            return { note: "is not a regular file; it was not read" };
+        if (stat.size > cap)
+            return { note: `is larger than ${Math.round(cap / 1024 / 1024)} MiB; it was not read` };
+        const buffer = Buffer.alloc(stat.size);
+        let offset = 0;
+        while (offset < stat.size) {
+            const n = readSync(fd, buffer, offset, stat.size - offset, offset);
+            if (n === 0)
+                break;
+            offset += n;
+        }
+        return decode(buffer.subarray(0, offset));
+    }
+    finally {
+        closeSync(fd);
+    }
+}